US State Department to Identify Contractor that Illegally Accessed Passport Files

The company, called The Analysis Corp., based in McClean, Va., has its roots in the cloak and dagger world of intelligence gathering and national security.

From it's Web site:

For the past 16 years, The Analysis Corporation (TAC) has provided invaluable service to the U.S. Government's national security effort. Increasingly, and especially since 9/11, TAC has made its most important contribution in the counterterrorism (CT) realm, supporting national watchlisting activities as well as other CT intelligence and analytic efforts.

Led by the former head of the National Counterterrorism Center (NCTC) and staffed by other former senior officials from the Intelligence Community, TAC is at the forefront of the fight to safeguard U.S. national interests.

The Analysis Corp. is a subsidiary of SFA Inc., which last year merged with a British firm called Global Strategies Group.

From a PRNewswire press release issued about that merger in February 2007:

WASHINGTON, Feb. 9 PRNewswire -- SFA, Inc., a leading US defense technology provider, and Global Strategies Group ('GLOBAL'), a British-owned international provider of security and risk mitigation strategies, have joined forces in a business combination to establish a new and unique breed of integrated national security company.

The combined enterprise will be capable of projecting a broad suite of technologies and specialist services worldwide and will offer unique expertise and comprehensive solutions in support of long term US defense and security priorities and, most immediately, support the US- led effort against international terrorism. With projected current year sales of $350M, the combined entity provides operators, security and counter terrorism experts, analysts, IT specialists, engineers and scientists from its office locations worldwide.

... SFA will operate as an independent subsidiary, retaining its name, management team, employees and infrastructure. SFA will also maintain its own US board of directors and operate with the appropriate national security protections.

The Analysis Corp. issued the following statement today through PRNewswire in reaction to the State Department's disclosure of its employee's role in the passport breaches.

This individual's actions were taken without the knowledge or direction of anyone at TAC and are wholly inconsistent with our professional and ethical standards.

TAC has an exemplary record of supporting the Department of State and other elements of the U.S. Government for close to two decades. We are fully cooperating with the Department of State in its investigation.

Specifically, we have honored the Department's request to delay taking any administrative action related to the employment of the individual in order to give the Department's Office of the Inspector General the opportunity to conduct its investigation.

We deeply regret that the incident occurred and believe it is an isolated incident.

Given The Analysis Corp. is affiliated with a foreign company that operates worldwide and has expertise in conducting highly sensitive national security work, this whole episode takes on some spooky overtones that one might expect Congress to take an interest in (so that it can be fully exposed to the sunlight)  or then again, maybe not.....

Following is a transcript of the press briefing provided at the close of the day today by the State Department related to "PassportGate."

Question Taken at the March 21, 2008 Daily Press Briefing
Unauthorized Access to Passport Records

Question: What are the names of the two companies whose employees gained unauthorized access to Senator Obama's passport files?

Answer

Stanley Corporation and The Analysis Corporation.

Question: What kind of information is contained in the Passport system?  What is the range of information that one might find in a passport file?

Answer

Generally, after the State Department issues a passport, all personal documents are returned to the applicant – the only document kept in the Department’s passport file is the passport application package. Passport files do not contain travel information, such as visa and entry stamps, from previous passports. Almost all passport files contain only a passport application form as submitted by the applicant.  

The application form asks for the biographic information needed to determine if the applicant qualifies for a U.S. Passport, including:  

 -- the applicant’s name, sex, date of birth, place of birth, social security number, marital status and mailing address and previous passport number if applicable.

-- the applicant’s physical descriptors like height, hair color and eye color.  

-- the names and place of birth of the applicant’s parents’.

The application form also asks for optional information that helps us to deliver applications on time, and to contact a citizen in case of an emergency:  

-- the occupation and employer of the applicant and contact information for the applicant as well as his or her emergency contact. (these have proved invaluable in contacting next of kin when a US citizen dies or needs assistance abroad).

-- Travel plans as completed by an applicant on the form would be in the record. (This is valuable in getting the passport to the applicant on time.)

In complex circumstances, for instance if there are grounds to suspect possible fraud or if a person born overseas claims citizenship by virtue of having an American citizen parent, we may need additional evidence to review the applications, and we keep this information in the passport file with the applications.

Question: How many total passport files are in the system?  

Answer

There are approximately 180-200 million records in this system.  

Question: Can you provide a copy of the language that appears on the computer regarding warning on accessing passport information?  

Answer

“PIERS USERS

You are permitted access to passport and consular personal records on a need to know basis.  Whether viewed or printed via PIERS, these are privileged records and are subject to the provisions of the Privacy Act of 1974.  They are not public records and may be released for use outside of the Department of State only in accordance with applicable Department regulations.  As a user of PIERS you are responsible for the protection of the record subject’s privacy.  PIERS users needing full copies of this passport record should request the record through PIERS.

DO NOT REPRODUCE OR PROVIDE COPIES of documents viewed or printed via PIERS for use outside of the Department of State.  Unauthorized release of these documents to non-Department staff, including to law enforcement agencies, must be made through the Research and Liaison Branch, CA/PPT/IML/R/RR, 1111 19th Street, N.W., Washington, D.C. 20524-1705.  Non-Department requesters should be referred directly to that office.  I have read the aforementioned Privacy warning and understand my responsibilities regarding the protection of passport and consular records.

YES                                                                  NO

Question: Does using the passport records system this way give one access to or links to other databases?

Answer

No.  Access to each passports systems application which an employee needs to conduct passport business is authorized separately.

Question: Were any laws broken?  

Answer

We must await a final determination of the facts to determine what precise laws may have been violated. The passport records at issue here are protected by the Privacy Act of 1974. That Act generally prohibits non-consensual disclosures of personal information about U.S. citizens from a Privacy Act system of records, unless an exception applies. One exception permits officers and employees of the agency who have a need for the record in the performance of their duties to review and use the record. Likewise, Department regulations permit contractors who have a need to review a record the same access as employees. However, access to passport records by contractors who do not have a need to know the information would violate the Privacy Act. In this case, Department policies make clear that passport records can be reviewed only for official reasons.

Question: When was the current database established?

Answer

The Passport Information Electronic Retrieval System (PIERS) was established in 2000 and contains digitally scanned applications.  PIERS incorporated the previous database, Passport File Miniaturization, that began in 1978.  From 1978 – 1999, passport applications were microfilmed.  In 1999, digital scanning began.

Question: Does the Inspector General have authority or ability to talk to or interview employees that have been fired?

Answer

The OIG can request interviews of former employees or contractors but would not have the authority to compel their cooperation under the Inspector General Act. They could, however, be served with a grand jury subpoena compelling them to testify before a Grand Jury.